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, Abstract 

t^. This paper shows that, if we could examine the entire history of a hidden variable, then we 

^ ' could efficiently solve problems that are believed to be intractable even for quantum computers. 

'^1^ . In particular, under any hidden-variable theory satisfying a reasonable axiom called "indiffer- 

' ence to the identity," we could solve the Graph Isomorphism and Approximate Shortest Vector 

problems in polynomial time, as well as an oracle problem that is known to require quantum 
exponential time. We could also search an TV-item database using O (TV^/'^) queries, as opposed 
to O i^N^/"^^ queries with Grover's search algorithm. On the other hand, the N'^^^ bound is 
\ optimal, meaning that we could probably not solve NP-complete problems in polynomial time. 

We thus obtain the first good example of a model of computation that appears slightly more 
powerful than the quantum computing model. 

oo ■ 

O 

^ ! 1 Introduction 

, It is often stressed that hidden-variable theories, such as Bohmian mechanics, yield exactly the 

' ' same predictions as ordinary quantum mechanics. On the other hand, these theories describe a 

P3 ■ different picture of physical reality, with an additional layer of dynamics beyond that of a state 

^ . vector evolving unitarily. This paper addresses a question that, to our knowledge, had never been 

qh| raised before: what is the computational complexity of simulating that additional dynamics? In 

other words, if we could examine a hidden variable's entire history, then could we solve problems 
in polynomial time that are intractable even for quantum computers? 

We present strong evidence that the answer is yes. The Graph Isomorphism problem asks 
whether two graphs G and H are isomorphic; while given a basis for a lattice £ G M", the Approx- 
imate Shortest Vector problem asks for a nonzero vector in C within a ^/n factor of the shortest 
one. We show that both problems are efficiently solvable by sampling a hidden variable's history, 
provided the hidden-variable theory satisfies a reasonable axiom that we call "indifference to the 
identity operation." By contrast, despite a decade of effort, neither problem is known to lie in 
BQP, the class of problems solvable in quantum polynomial time with bounded error probability.^ 
Thus, if we let DQP (Dynamical Quantum Polynomial-Time) be the class of problems solvable in 
our new model, then this already provides circumstantial evidence that BQP is strictly contained 
in DQP. 

However, the evidence is stronger than this. For we actually show that DQP contains an entire 
class of problems, of which Graph Isomorphism and Approximate Shortest Vector are special 
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cases. Computer scientists know this class as Statistical Zero Knowledge, or SZK. Furthermore, 
in previous work pi we showed that "relative to an oracle," SZK is not contained in BQP. This is 
a technical concept implying that any proof of SZK C BQP would require techniques unlike those 
that are currently known. Combining our result that SZK C DQP with the oracle separation of |2j, 
we obtain that BQP 7^ DQP relative to an oracle as well. Given computer scientists' longstanding 
inability to separate basic complexity classes, this is nearly the best evidence one could hope for 
that sampling histories yields more power than standard quantum computation. 

Besides solving SZK problems, we also show that by sampling histories, one could search an 
unordered database of items for a single "marked item" using only O (A^^/^) database queries. 
By comparison, Grover's quantum search algorithm JJ| requires B (A^^/^) queries, while classical 
algorithms require Q (N) queries.^ On the other hand, we also show that our N^^^ upper bound is 
the best possible — so even in the histories model, one cannot search an A^-item database in (log A^)'^ 
steps for some fixed power c. This implies that NP ^ DQP relative to an oracle, which in turn 
suggests that DQP is still not powerful enough to solve NP-complete problems in polynomial time. 
Note that while Graph Isomorphism and Approximate Shortest Vector are in NP, it is strongly 
believed that they are not NP-complete. 

At this point we should address a concern that many readers will have. Once we extend 
quantum mechanics by positing the "unphysical" ability to sample histories, isn't it completely 
unsurprising if we can then solve problems that were previously intractable? We believe the 
answer is no, for three reasons. 

First, almost every change that makes the quantum computing model more powerful, seems 
to make it so much more powerful that NP-complete and even harder problems become solvable 
efficiently. To give some examples, NP-complete problems can be solved in polynomial time using 
a nonlinear Schrodinger equation, as shown by Abrams and Lloyd |4j; using closed timelike curves, 
as shown by Bacon [HI; or using a measurement rule of the form for any p ^ 2, as shown by 
us inj. It is also easy to see that we could solve NP-complete problems if, given a quantum state 
IV'), we could request a classical description of \ip), such as a list of amplitudes or a preparation 
procedure.^ By contrast, ours is the first independently motivated model we know of that seems 
more powerful than quantum computing, but only slightly so.^ Moreover, the striking fact that 
unordered search in our model takes about N^^^ steps, as compared to A^ steps classically and 
A^^/^ quantum-mechanically, suggests that DQP somehow "continues a sequence" that begins with 
P and BQP. It would be interesting to find a model in which search takes N^^"^ or N^^^ steps. 

The second reason our results are surprising is that, given a hidden variable, the distribution 
over its possible values at any single time is governed by standard quantum mechanics, and is 
therefore efficiently samplable on a quantum computer. So if examining the variable's history 
confers any extra computational power, then it can only be because of correlations between the 
variable's values at different times. 

The third reason is our criterion for success. We are not saying merely that one can solve 
Graph Isomorphism under some hidden-variable theory; or even that, under any theory satisfying 

^For readers unfamiliar with asymptotic notation: O {f (N)) means "at most order f (N)" fl{f{N)) means "at 
least order / (N)" and (/ (A*')) means "exactly order / (N)." 

^For as Abrams and Lloyd |1] observed, we can so arrange things that = jO) if an NP-complete instance of 
interest to us has no solution, but l-i/i) = y/1 — e |0) + \/£|l) for some tiny e if it has a solution. 

*One can define other, less motivated, models with the same property by allowing "non-collapsing measurements" 
of quantum states, but these models are very closely related to ours. Indeed, a key ingredient of our results will be 
to show that certain kinds of non-collapsing measurements can be simulated using histories. 
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the indifference axiom, there exists an algorithm to solve it; but rather that there exists a single 
algorithm that solves Graph Isomorphism under any theory satisfying indifference. Thus, we must 
consider even theories that are specifically designed to thwart such an algorithm. 

But what is the motivation for our results? The first motivation is that, within the community 
of physicists who study hidden-variable theories such as Bohmian mechanics, there is great interest 
in actually calculating the hidden- variable trajectories for specific physical systems |151 112) . Our 
results show that, when many interacting particles are involved, this task might be fundamentally 
intractable, even if a quantum computer is available. The second motivation is that, in classical 
computer science, studying "unrealistic" models of computation has often led to new insights into 
realistic ones; and likewise we expect that the DQP model could lead to new results about standard 
quantum computation. Indeed, in a sense this has already happened. For our result that SZK 
BQP relative to an oracle |5] grew out of work on the BQP versus DQP question. Yet the "quantum 
lower bound for the collision problem" underlying that result provided the first evidence that 
cryptographic hash functions could be secure against quantum attack, and ruled out a large class 
of possible quantum algorithms for Graph Isomorphism, Approximate Shortest Vector, and related 
problems. 



1.1 Outline of Paper 

The precise definition of a hidden-variable theory that we use in this paper was developed in a 
companion paper 01 . Familiarity with ^ is helpful but not essential for understanding this paper. 
In Section 12 we review the relevant concepts from T, and then formally define DQP as the class 
of problems solvable by a classical polynomial-time algorithm with access to a "history oracle." 
Given a sequence of quantum circuits as input, this oracle returns a sample from a corresponding 
distribution over histories of a hidden variable, according to some hidden-variable theory T. The 
oracle can choose T "adversarially," subject to two constraints: T must be robust to small errors 
(since otherwise the definition of DQP could depend on the choice of gate set), and it must satisfy 
the indifference axiom. 

So what is the indifference axiom, then? Intuitively it says that, given a bipartite state 
IV") G T~(-A ®'Hb (entangled or unentangled) , if a unitary operation acts only on the TLa part of 
1-0) (i.e. has the form U ® I), then the hidden-variable transitions can also only involve the TCa 
part. Note that this is quite different from locality in the sense of Bell's theorem: the probability of 
transitioning between two basis states \xa) ^ \xb) and \yA) ® \xb) can depend on the complete state 
IV'); all we require is that if xb / ys, then the probability of transitioning between \xa) ® \xb) 
and \yA) ® \yB) is zero. Indifference is a substantive axiom, and is violated (for example) by 
Bohmian mechanics. However, to us it simply expresses the idea that, if we have a state such as 
(I a) -|- 1 6) -|- |c) -|- \d)) /2, and a partial measurement yields a new state 



where \Rab) and \Rcd) denote two configurations of a recording apparatus, then so long as we leave 
the recording apparatus alone, all further hidden- variable transitions should be between \a) and 
\b) or between |c) and \d), not between (say) \a) and |c). If we abandoned this axiom, then we 
would need some other way to rule out the degenerate hidden-variable theory, which takes the 
hidden- variable values at different times to be completely independent of one another. Were this 
"product theory" allowed, we would have DQP = BQP for trivial reasons. 
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An earlier version of this paper required another axiom — symmetry under permutations of basis 
states — which seems much harder to justify than indifference. However, we have since been able 
to eliminate the dependence of our algorithms on the symmetry axiom. 

Section I2I establishes the most basic facts about DQP: for example, that BQP C DQP, and that 
DQP is independent of the choice of gate set. Then Section |1] presents the "juggle subroutine," a 
crucial ingredient in both main algorithms of the paper. Given a state of the form (|a) + |6)) /^/2 
or (|a) — /y/2, the goal of this subroutine is to "juggle" a hidden variable between \a) and \b), 
so that when we inspect the hidden variable's history, both \a) and \b) are observed with high 
probability. The difficulty is that this needs to work under any indifferent hidden-variable theory. 

Next, Section El combines the juggle subroutine with a technique of Valiant and Vazirani ^2] 
to prove that SZK C DQP, from which it follows in particular that Graph Isomorphism and Ap- 
proximate Shortest Vector are in DQP. Then Section IB] applies the juggle subroutine to search 
an A^-item database in O (A^^/^) queries, and also proves that this N^^^ bound is optimal. We 
conclude in Section [7| with some directions for further research. 

2 The Computational Model 

We now explain our model of computation, building our way up to the complexity class DQP. Our 
starting point is the definition of hidden-variable theory that we gave in [1^. To recap from that 
paper: for us a hidden- variable theory is simply a family of functions {Sn} niz^i 2 }) where each 
Sn maps an N X N density matrix p and an A^ x A^ unitary matrix U onto an A^ x A^ stochastic 
matrix S = Sn {p, U). In this paper, p will always be a pure state of / = log2 A^ qubits. That is, 
p = 1^) {tl)\ where 

xG{0,l}' 

What is essential is that S map the probability distribution induced by measuring \tjj) in the 
computational basis {|2;)}^g|o 1}') onto the probability distribution induced by measuring U in 
that same basis. More formally, let {M)^y denote the entry in the x^^ column and y*^ row of 
matrix M, and let 

a-G{0,l}' 

Then we require that for all y € {0, 1}', 

xG{0,l}' 

It is clear that there are infinitely many theories satisfying the above marginalization axiom; the 
simplest one is the product theory VT, which sets {S)^y = \[3y\^ for all To narrow down the 

choices, in we proposed seven additional axioms that we might want any hidden- variable theory 
to satisfy. We then showed that, although not all of the axioms can be satisfied simultaneously, two 
of the most important ones — called indifference and robustness — can be satisfied simultaneously. 

Let us restate those two axioms in the present context. Indifference says that if U is generalized 
block-diagonal (i.e. a permutation of a block-diagonal matrix), then 5 is also generalized block- 
diagonal with the same block structure or some refinement thereof. So in particular, if |^) belongs 
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to a tensor-product Hilbert space TCa'S'TCb, and if U acts only on TCa (i-e. never maps a basis state 
\xa) (d) \xb) to Iua) (8 Ivb) where xb / Ub), then 5 {\ip) , C/) acts only on Ti.A as well. Robustness 
says that 5 is insensitive to small perturbations of or U. To make this intuition formal, 
we call a theory robust if for all b > 0, there exists c > such that for all /, all pairs of states 



x'e{o,i} 



I ar\x) and 



such that 



xy 



u 



xy 



tpj = I]^.g|o,i}i k) such that (V'lV') > 1 
< 2^^' for all X, y, we have 



and all U and U 



xy 



S] iotiI 

xy 



< 2" 



for all X, y, where 5 = 5 {{ip) , U) and 5 = 5^ -0/ > f^j 

It is easy to show that the product theory VT satisfies robustness but not indifference. In 
we analyzed three other hidden-variable theories: the Dieks theory PT, which satisfies indifference 
but not robustness; the flow theory J-T , which satisfies both indifference and robustness; and the 
Schrddinger theory ST, which satisfies indifference, and which we conjecture satisfies robustness. 
The details of those theories are mostly irrelevant for this paper. Indeed, our algorithms will work 
under any hidden-variable theory that satisfies the indifference axiom. On the other hand, if we 
take into account that even in theory (let alone in practice) , a generic unitary cannot be represented 
exactly with a finite universal gate set, only approximated arbitrarily well, then we also need the 
robustness axiom. Thus, a key result from that we rely on is that there exists a hidden- variable 
theory (namely J-T) satisfying both indifference and robustness. 

Let a quantum computer have the initial state |0)®', and suppose we apply a sequence U = 
(Ui, . . . , Ut) of unitary operations, each of which is implemented by a polynomial-size quantum 
circuit. Then a history of a hidden variable through the computation is a sequence H = (vq, . . . ,vt) 
of basis states, where vt is the variable's value immediately after Ut is applied (thus vq = |0)®'). 
Given any hidden- variable theory T, we can obtain a probability distribution Q(U,T) over histories 
by just applying T repeatedly, once for each Ut-, to obtain the stochastic matrices 
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(|0)«',C/i), s(Ui\Qf\U2 



5 C/t-i---?7i|0)«',C/t 



Note that 0,{L{,T) is a Markov distribution; that is, each vt is independent of the other fj's 
conditioned on vt-i and vt+i- Admittedly, Q {U, T) could depend on the precise way in which the 
combined circuit Ut ■ ■ - Ui is "sliced" into component circuits C/i, . . . , Ut- But as we showed in pi, 
such dependence on the granularity of unitaries is unavoidable in any hidden- variable theory other 
than VT- 

Given a hidden-variable theory T, let O (T) be an oracle that takes as input a positive integer 
/, and a sequence of quantum circuits li = (Ui, . . . , Ut) that act on / qubits. Here each Ut is 
specified by a sequence [gt,i, • • • , 9t,m{t)) of gates chosen from some finite universal gate set Q- The 
oracle O (T) returns as output a sample (uq, • • • , vt) from the history distribution (U, T) defined 
previously. Now let A be a deterministic classical Turing machine that is given oracle access to 
O (T). The machine A receives an input x, makes a single oracle query to O (T), then produces 
an output based on the response. We say a set of strings L is in DQP if there exists an A such 
that for all sufficiently large n and inputs x € {0, 1}", and all theories T satisfying the indifference 
and robustness axioms, A correctly decides whether x £ L with probability at least 2/3, in time 
polynomial in n. 
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Let us make some remarks about the above definition. There is no real significance in our 
requirement that A be deterministic and classical, and that it be allowed only one query to O (T). 
We made this choice only because it suffices for our upper bounds; it might be interesting to consider 
the effects of other choices. However, other aspects of the definition are not arbitrary. The order 
of quantifiers matters; we want a single A that works for any hidden- variable theory satisfying 
indifference and robustness. Also, we require A to succeed only for sufficiently large n since by 
choosing a large enough robustness parameter c, an adversary might easily make A incorrect on a 
finite number of instances. 

3 Basic Results 

Having defined the complexity class DQP, in this short section we establish its most basic properties. 
First of all, it is immediate that BQP C DQP; that is, sampling histories is at least as powerful as 
standard quantum computation. For vi, the first hidden- variable value returned by O (T), can be 
seen as simply the result of applying a polynomial-size quantum circuit Ui to the initial state |0)®' 
and then measuring in the standard basis. 
A key further observation is the following. 

Proposition 1 Any universal gate set yields the same complexity class DQP. By universal, we 
mean here that any unitary matrix (real or complex) can be approximated, without the need for 
ancilla qubits. 

Proof. Let Q and G be universal gate sets, and let U he a circuit made of poly (n) gates from G- 
Then the Solovay-Kitaev Theorem |131 114j implies that we can approximate U to accuracy (say) 
2-ni j-|y ygij^g poly(n,/) = poly (n) gates from Q, which act on the same set of qubits as U does. 
Furthermore, the approximating circuit can be efficiently constructed. Now from the definition of 
robustness, for all T there exists a c > such that, if we approximate each Ut & U to accuracy 
2~'^\ then the distribution over histories seen by A is statistically indistinguishable from what it 
would have been were the Uts represented exactly. (This occurs when 6 = 3 for example.) Clearly 
2-ni ^ 2"^/ fQ], sufficiently large n. ■ 

Unfortunately, the best upper bound on DQP we have been able to show is DQP C EXP; that 
is, any problem in DQP is solvable in deterministic exponential time. The proof is trivial, but 
is the one place in the paper that relies on a specific hidden- variable theory from 1.. Let T be 
the flow theory J-T ^ with the slight modification that we omit the step from ^ of symmetrizing 
over all permutations of basis states. Then by using the Ford-Fulkerson algorithm HH^, we can 
clearly construct the requisite maximum flows in time polynomial in 2' (hence exponential in n), 
and thereby calculate the probability of each possible history (fi, . . . , vt) to suitable precision. If 
we include the symmetrization step, then we only know how to calculate these probabilities in 
probabilistic exponential time. 

4 The Juggle Subroutine 

This section presents a crucial subroutine that will be used in both algorithms of this paper: the 
algorithm for simulating statistical zero knowledge in Section[51 and the algorithm for search in A^^/^ 
queries in Sectional Given an /-qubit state I'i/') = (|a) + \b)) /\/2 that is an equal superposition of 
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two unknown basis states, the goal of the juggle subroutine is to learn both a and b. The name 
arises because our strategy will be to "juggle" a hidden variable, so that if it starts out at \a) then 
with non-negligible probability it transitions to \b), and vice versa. Inspecting the entire history of 
the hidden variable will then reveal both a and b, as desired. The difficulty is that we need a single 
subroutine that does this under all hidden-variable theories satisfying the indifference axiom — even 
theories that are designed specifically to thwart such a subroutine. To meet this difficulty, we will 
apply a pair of unitaries to that force the hidden variable to "forget" whether it started at \a) 
or 1 6). We will then invert those unitaries to return the state to {ip), at which point the hidden 
variable must be unequal to its initial value with probability 1/2. 

We now give the subroutine. The first unitary, Ui, consists of Hadamard gates on / — 1 qubits 
chosen uniformly at random, and the identity operation on the remaining qubit, i. Next U2 
consists of a Hadamard gate on qubit i. Finally U3 consists of Hadamard gates on all / qubits. 
Let a = ai . . .ai and b = bi . . .bi. Then since a 7^ 6, we have Oj 7^ bi with probability at least l/l. 
Assuming that occurs, the state 

\2;G{0,1}' : Zi=a, ze{0,l}' : Zi=b, J 

assigns nonzero amplitude to all 2' basis states. Then U2U1 |^) assigns nonzero amplitude to 2'~^ 
basis states \z), namely those for which a ■ z = b ■ z (mod 2). Finally U3U2U1 \^) = \ip). 

Let vt be the value of the hidden variable after Ut is applied. Then assuming Oj ^ bi, we claim 
that V3 is independent of vq. So in particular, if vq = \a) then ^3 = |6) with 1/2 probability, and if 
vq = \b) then V3 = \a) with 1/2 probability. To see this, observe that when C/i is applied, there is 
no interference between basis states \z) such that Zi = a^, and those such that Zi = bi. So by the 
indifference axiom, the probability mass at \a) must spread out evenly among all 2'^^ basis states 
that agree with a on the i*^ bit, and similarly for the probability mass at Then after U2 is 
applied, V2 can differ from vi only on the i^'^ bit, again by the indifference axiom. So each basis 
state of U2U1 {ip) must receive an equal contribution from probability mass originating at |a), and 
probability mass originating at Therefore V2 is independent of vq, from which it follows that 
^3 is independent of vq as well. 

Unfortunately, the juggle subroutine only works with probability 1/(2/) — for it requires that 
ai ^ bi, and even then, inspecting the history {vq,vi, . . .) only reveals both \a) and |6) with prob- 
ability 1/2. Furthermore, the definition of DQP does not allow more than one call to the history 
oracle. However, all we need to do is pack multiple subroutine calls into a single oracle call. That 
is, choose C/4 similarly to Ui (except with a different value of i), and set C/5 = U2 and Uq = U3. 
Do the same with Uj, Us, and Uq, and so on. Since C/3, Uq, Uq, ... all return the quantum state to 
the effect is that of multiple independent juggle attempts. With 2/^ attempts, we can make 
the failure probability at most (1 — 1/(2/))^' < e~'. 

As a final remark, it is easy to see that the juggle subroutine works equally well with states of 
the form \ip) = (|a) — /\/2- This will prove useful in Section |H1 

5 Simulating SZK 

Our goal is to show that SZK C DQP. Here SZK, or Statistical Zero Knowledge, was originally 
defined as the class of all problems that possess a certain kind of "zero- knowledge proof protocol" — 



7 



that is, a protocol between an omniscient prover and a verifier, by which the verifier becomes 
convinced of the answer to a problem, yet without learning anything else about the problem. 
However, for our purposes this cryptographic definition of SZK is irrelevant. For Sahai and Vadhan 
jl6j have given an alternate and much simpler characterization: a problem is in SZK if and only if 
it can be reduced to a problem called Statistical Difference, which involves deciding whether two 
probability distributions are close or far. 

More formally, let -Pq and -Pi be functions that map n-bit strings to n-bit strings, and that are 
specified by classical polynomial-time algorithms. Let Aq and Ai be the probability distributions 
over Pq (x) and Pi (x) respectively, if x G {0, 1}" is chosen uniformly at random. Then the problem 
is to decide whether ||Ao — Ai|| is less than 1/3 or greater than 2/3, given that one of these is the 
case. Here 

l|Ao-A,|| = l ^ 



Pr IPq (x) = y]- Pr [Pi (x) = y] 



ye{o,i}" 

is the variation distance between Aq and Ai. 

To illustrate, let us show that Graph Isomorphism is in SZK. Given two graphs Go and Gi, 
take Aq to be the uniform distribution over all permutations of Gq, and Ai to be uniform over all 
permutations of Gi. This way, if Gq and Gi are isomorphic, then Aq and Ai will be identical, 
so II Aq — Ai|| = 0. On the other hand, if Gq and Gi are non-isomorphic, then Aq and Ai will be 
perfectly distinguishable, so ||Ao — Ai|| = 1. Since Aq and Ai are clearly samplable by polynomial- 
time algorithms, it follows that any instance of Graph Isomorphism can be expressed as an instance 
of Statistical Difference. For a proof that Approximate Shortest Vector is in SZK, we refer the 
reader to Aharonov and Ta-Shma f^. 

Our proof will use the following "amplification lemma" from |16|:^ 

Lemma 2 (Sahai and Vadhan) Given efficiently- samplahle distributions Aq and Ai, we can 
construct new efficiently- samplahle distributions Aq and A'^, such that if — < 1/3 then 
- A;|| < 2-", while if ||Ao - Ai|| > 2/3 then \\A.'q - A;|| > 1 - 2"". 

In particular, Lemma[21means we can assume without loss of generality that either || Aq — Ai || < 
2""" or II Aq — Ai|| > 1 — 2""" for some constant c > 0. 

Having covered the necessary facts about SZK, we can now proceed to the main result. 

Theorem 3 SZK C DQP. 

Proof. We show how to solve Statistical Difference by using a history oracle. For simplicity, 
we start with the special case where Pq and Pi are both one-to-one functions. In this case, the 
circuit sequence U given to the history oracle does the following: it first prepares the state 

^ ^ \b)\x)\P,{x)). 



2(n+l)/2 

6G{0,l},a;g{0,l}" 

It then applies the juggle subroutine to the joint state of the \h) and |x) registers, taking I = n + 1. 
Notice that by the indifference axiom, the hidden variable will never transition from one value of 



^Note that in this lemma, the constants 1/3 and 2/3 are not arbitrary; it is important for technical reasons that 
(2/3)^ > 1/3. 
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Pb (x) to another — exactly as if we had measured the third register in the standard basis. Ah that 
matters is the reduced state lip) of the first two registers, which has the form (|0) |a;o) + |1) jypl 
for some xq^x\ if ||Ao — Ai|| = 0, and \h) \x) for some 6, x if ||Ao — Ai|| = 1. We have aheady seen 
that the juggle subroutine can distinguish these two cases: when the hidden-variable history is 
inspected, it will contain two values of the \h) register in the former case, and only one value 
in the latter case. Also, clearly the case ||Ao — Ai|| < 2""'' is statistically indistinguishable from 
II Aq — Ai II = with respect to the subroutine, and likewise || Aq — Ai || > 1— 2~" is indistinguishable 
from II Aq — Aill = 1. 

We now consider the general case, where Pq and Pi need not be one-to-one. Our strategy is to 
reduce to the one-to-one case, by using a well-known hashing technique of Valiant and Vazirani 
Let Pn,fc be the uniform distribution over all affine functions mapping {0, 1}" to {0, 1}''', where we 
identify those sets with the finite fields and respectively. What Valiant and Vazirani showed 
is that, for all subsets A C {0, 1}" such that 2'^^^ < |^| < 2^-1, and all s G {0, 1}'', 



Pr [|An/i-^(s)| 



1 

> -. 



As a corollary, the expectation over h G T)n,k of 

{s G {0,1}'= : \Ar\h-^[s)\ = 1} 
is at least 2^ /d>. It follows that, if x is drawn uniformly at random from A, then 

Pr[|An/.-i(M^))| = i] >^>^- 

h,x \A\ 4 

This immediately suggests the following algorithm for the many-to-one case. Draw k uniformly at 
random from {2, . . . , n -|- 1}; then draw /iq, hi G Vn^k- Have U prepare the state 

^ \h)\x)\P,{x))\h,{x)), 

6e{0,l},xG{0,l}" 

and then apply the juggle subroutine to the joint state of the \h) and |x) registers, ignoring the 
|Pf, (x)) and |/ib (x)) registers as before. 

Suppose II Aq — Ai|| = 0. Also, given a value s = Pb (x), let Aq = P^^ (s) and Ai = P^^ (s), 
and suppose 2'="^ < |^o| = |^i| < 2''"^ Then 

Pr [\Aonh^\s)\ = lA\Ainh^\s)\ = l]> (l) , 

s,ho,hi v^y 

since the events \ Aq D /ig ^ = 1 and \Ai n h^^ {s)\ = 1 are independent of each other conditioned 
on s. Assuming both events occur, as before the juggle subroutine will reveal both |0) |xo) and 
|1) |xi) with high probability, where xq and xi are the unique elements of Aq n /ig (s) and Ai n 
h^^ (s) respectively. By contrast, if ||Ao — Ai|| = 1 then only one value of the |6) register will 
ever be observed. Again, replacing ||Ao — Ai|| = by ||Ao — Ai|| < 2""'', and ||Ao — Ai|| = 1 by 
II Aq — Ai|| > 1 — 2~" , can have only a negligible effect on the history distribution. 

Of course, the probability that the correct value of k is chosen, and that Aq D h^^ (s) and 
Ai n h^^ (s) both have a unique element, could be as low as 1/ (16n). To deal with this, we simply 
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increase the number of calls to the juggle subroutine by an O (n) factor, drawing new values of 
k, ho, hi for each call. We pack multiple subroutine calls into a single oracle call as described in 
Section 0J except that now we uncompute the entire state (returning it to 1 • • • 0) ) and then recom- 
pute it between subroutine calls. A final remark: since the algorithm that calls the history oracle is 
deterministic, we "draw" new values of k, /iq, hi by having U prepare a uniform superposition over 
all possible values. The indifference axiom justifies this procedure, by guaranteeing that within 
each call to the juggle subroutine, the hidden-variable values of k, ho, and hi remain constant. ■ 
Let us end this section with some brief remarks about the oracle result of [2] . Given a function 
g : {0, 1}" {0, 1}", the collision problem is to decide whether g is one-to-one or two-to-one, given 
that one of these is the case. The question is, how many queries to g are needed to solve this 
problem (where a query just returns g (x) given x)? It is not hard to see that G (2"/^) queries 
are necessary and sufficient for classical randomized algorithms. What we showed in [2] is that 
queries are needed by any quantum algorithm as well. Subsequently Shi ^ managed 
to improve the quantum lower bound to O (2"/^) queries, thereby matching an upper bound of 
Brassard, H0yer, and Tapp 'W. On the other hand, the collision problem is easily reducible to the 
Statistical Difference problem, and is therefore solvable in polynomial time by sampling histories. 
This is the essence of the statement that BQP ^ DQP relative to an oracle. 

6 Search in N'^^^ Queries 

Given a Boolean function / : {0,1}" {0,1}, the database search problem is simply to find a 
string X such that / (x) = 1. We can assume without loss of generality that this "marked item" x 
is unique.^ We want to find it using as few queries to / as possible, where a query returns / (y) 
given y. 

Let N = 2^. Then classically, of course, Q (N) queries are necessary and sufficient. By 
querying / in superposition, Grover's algorithm JJ| finds x using queries, together with 

O (iV^/^) auxiliary computation steps (here the O hides a factor of the form (log A^)'^). Bennett et 
al. IS] showed that any quantum algorithm needs 17 (A^^/-^) queries. 

In this section, we show how to find the marked item by sampling histories, using only O (Afi/3^ 
queries and O (A^^/^) computation steps. Formally, the model is as follows. Each of the quantum 
circuits Ui, . . . ,Ut that algorithm A gives to the history oracle O (T) is now able to query /. 
Suppose Ut makes qt queries to /; then the total number of queries made by A is defined to be 
Q = qi + ■ ■ ■ + qT- The total number of computation steps is at least the number of steps required 
to write down Ui, . . . , Ut, but could be greater. 

Theorem 4 In the DQP model, we can search a database of N items for a unique marked item 
using O (A^^/'^) queries and O (A^^^'^) computation steps. 

Proof. Assume without loss of generality that N = 2^ with n|3, and that each database item 
is labeled by an n-bit string. Let x G {0, 1}" be the label of the unique marked item. Then 
the sequence of quantum circuits U does the following: it first runs O (2"/^) iterations of Grover's 

®For if there are multiple marked items, then we can reduce to the unique marked item case by using the Valiant- 
Vazirani hashing technique described in Theorem |3 
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algorithm, in order to produce the n-qubit state a\x) + j3 X]j/g{o i}" 1^)' '^here 



1 

a 



2«/3 + 2-"/3+i + 1 ' 
13 = 2-"/3a 



(one can check that this state is normahzed). Next li applies Hadamard gates to the first n/3 
qubits. This yields the state 



yG{0,l}"''^ 2G{0,1}^"''^ 



where xa consists of the first n/3 bits of x, and xb consists of the remaining 2n/3 bits. Let Y be 
the set of 2"/^ basis states of the form \y) \xb)i and Z be the set of 2^"/^ basis states of the form 
|0)®"/^|z). 

Notice that 2-"/^q = T^/^(5. So with the sole exception of lO)®"/^ \xb) (which belongs to both 
Y and Z), the "marked" basis states in Y have the same amplitude as the "unmarked" basis states 
in Z. This is what we wanted. Notice also that, if we manage to find any \y) \xb) £ Y , then we 
can find x itself using 2"/^ further classical queries: simply test all possible strings that end in x^. 
Thus, the goal of our algorithm will be to cause the hidden variable to visit an element of Y , so 
that inspecting the variable's history reveals that element. 

As in Theorem El the tools that we need are the juggle subroutine, and a way of reducing many 
basis states to two. Let s be drawn uniformly at random from {0, 1}"'''^. Then U appends a third 
register to and sets it equal to \z) if the first two registers have the form jo)®"/^ or to \s, y) 
if they have the form \y) \xb)- Disregarding the basis state jo)®"'''^ \xb) for convenience, the result 
is 





-ir^-y\y)\xB)\s,y)+ 10)®"/' k 

26{0,l}^"/^ 

Next U applies the juggle subroutine to the joint state of the first two registers. Suppose the 
hidden- variable value has the form |0)®"''^ \ z) \z) (that is, lies outside Y). Then with probability 
2~"/3 over s, the first n/3 bits of z are equal to s. Suppose this event occurs. Then conditioned 
on the third register being \z), the reduced state of the first two registers is 

{-IY^-^b\zb)\xb) + \Q)'^'^'''\z) 

where zb consists of the last n/3 bits of z. So it follows from Section|l]that with probability Vl (1/n), 
the juggle subroutine will cause the hidden variable to transition from |0)®"/'^ 1^) to \zb) \xb), and 
hence from ZtoY. 

The algorithm calls the juggle subroutine (2"/^n) = (A^-*^/^ log A^) times, drawing a new 
value of s and recomputing the third register after each call. Each call moves the hidden variable 
from Z to Y with independent probability 0, (2~"'/^/n); therefore with high probability some call 
does so. Note that this juggling phase does not involve any database queries. Also, as in Theorem 
01 "drawing" s really means preparing a uniform superposition over all possible s. Finally, the 
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probability that the hidden variable ever visits the basis state |0) ' \xb) is exponentially small 
(by the union bound), which justifies our having disregarded it. ■ 

A curious feature of Theorem|l]is the tradeoff between queries and computation steps. Suppose 
we had run Q iterations of Grover's algorithm, or in other words made Q queries to /. Then 
provided Q < \/N , the marked state \x) would have occurred with probability 17 (^Q'^/N^, meaning 
that O {N/Q'^^ calls to the juggle subroutine would have been sufficient to find x. Of course, the 
choice of Q that minimizes max {Q, N/Q^} is g = iVV3 ti^g Qti^gj, Y^^^^^ Yiad we been willing 

to spend O {N) computation steps, we could have found x with only a single query! Thus, one 
might wonder whether some other algorithm could push the number of queries below N^^^, without 
simultaneously increasing the number of computation steps. The following theorem rules out that 
possibility. 

Theorem 5 In the DQP model, (A^-^/^) computation steps are needed to search an N-item 
database for a unique marked item. As a consequence, there exists an oracle relative to which 
NP ^ DQP; that is, NP-complete problems are not efficiently solvable by sampling histories. 

Proof. Let N = 2^ and / : {0,1}" {0,1}- Given a sequence of quantum circuits U = 
{Ui, . . . , Ut) that query /, and assuming that x £ {0, 1}" is the unique string such that / (x) = 1, 
let IV't (x)) be the quantum state after Ut is applied but before Ut+i is. Then the "hybrid argument" 
of Bennett et al. [HI implies that, by simply changing the location of the marked item from x to 
X*, we can ensure that 

iiiv^a^))-iV'a^*))ii = o(^) 

where || || represents trace distance, and Qt is the total number of queries made to f hy Ui, ... ,Ut. 
Therefore O (^Ql/N^ provides an upper bound on the probability of noticing the a; — > x* change 
by monitoring vt, the value of the hidden variable after Ut is applied. So by the union bound, the 
probability of noticing the change by monitoring the entire history {vi, . . . ,vt) is at most of order 

E Qit ^ TQt 
W - N 

t=i 

This cannot be Q (1) unless T = n (A^^/^) or Qt = ^ (A^^^^), either of which imphes an n (A^^/^) 
lower bound on the total number of steps. 

To obtain an oracle relative to which NP ^ DQP, we can now use a standard and well-known 
"diagonalization method" due to Baker, Gill, and Solovay [Zj to construct an infinite sequence 
of exponentially hard search problems, such that any DQP machine fails on at least one of the 
problems, whereas there exists an NP machine that succeeds on all of them. We omit the details. 



7 Discussion 

Perhaps the most interesting problem left open by this paper is the computational complexity 
of simulating Bohmian mechanics. We strongly conjecture that this problem, like the hidden- 
variable problems we have seen, is strictly harder than simulating an ordinary quantum computer. 

^One should not make too much of this fact; one way to interpret it is simply that the "number of queries" should 
be redefined as Q + T rather than Q. 
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The trouble is that Bohmian mechanics does not quite fit in our framework: as discussed in 
we cannot have deterministic hidden-variable trajectories for discrete degrees of freedom such as 
qubits. Even worse, Bohmian mechanics violates the continuous analogue of the indifference 
axiom. On the other hand, this means that by trying to implement (say) the juggle subroutine 
with Bohmian trajectories, one might learn not only about Bohmian mechanics and its relation 
to quantum computation, but also about how essential the indifference axiom really is for our 
implementation. 

On the computer science side, a key open problem is to show better upper bounds on DQP. 
Recall that we were only able to show DQP C EXP, by giving a classical exponential-time algorithm 
to simulate the flow theory TT . Can we improve this to (say) DQP C PS PACE? Clearly it would 
suffice to give a PS PACE algorithm that computes the transition probabilities for some theory T 
satisfying the indifference and robustness axioms. On the other hand, this might not be necessary — 
that is, there might be an indirect simulation method that does not work by computing (or even 
sampling from) the distribution over histories. It would also be nice to pin down the complexities 
of simulating specific hidden-variable theories, such as TT and ST . 
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